diff --git a/.gitignore b/.gitignore index 73b701f..656c76a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ SOURCES/container-selinux.tgz -SOURCES/selinux-policy-420bacb.tar.gz -SOURCES/selinux-policy-contrib-876387c.tar.gz +SOURCES/selinux-policy-33fd484.tar.gz +SOURCES/selinux-policy-contrib-4beb213.tar.gz diff --git a/.selinux-policy.metadata b/.selinux-policy.metadata index c1bc4dd..36c1b3a 100644 --- a/.selinux-policy.metadata +++ b/.selinux-policy.metadata @@ -1,3 +1,3 @@ -a5fc34a7fbfd13a2b86609bdea0bcc2b312163d1 SOURCES/container-selinux.tgz -3756201d4d69bb4834cfaac8aff3398a1d8b482c SOURCES/selinux-policy-420bacb.tar.gz -4de0c405f689cec37c49a8fc5054990f0fa27007 SOURCES/selinux-policy-contrib-876387c.tar.gz +99c5dc0dbb5f824b2cc29d18e8911401677e0bb1 SOURCES/container-selinux.tgz +4da13e377b1e178962423475a04832ed39581394 SOURCES/selinux-policy-33fd484.tar.gz +45d3dbd0265f43953376baacdbc070a566eb429b SOURCES/selinux-policy-contrib-4beb213.tar.gz diff --git a/SOURCES/modules-targeted-contrib.conf b/SOURCES/modules-targeted-contrib.conf index 02c9839..7c6c66d 100644 --- a/SOURCES/modules-targeted-contrib.conf +++ b/SOURCES/modules-targeted-contrib.conf @@ -2389,13 +2389,6 @@ minissdpd = module freeipmi = module # Layer: contrib -# Module: freeipmi -# -# ipa policy module contain SELinux policies for IPA services -# -ipa = module - -# Layer: contrib # Module: mirrormanager # # mirrormanager policy diff --git a/SPECS/selinux-policy.spec b/SPECS/selinux-policy.spec index 5cd9c1b..fc9caf0 100644 --- a/SPECS/selinux-policy.spec +++ b/SPECS/selinux-policy.spec @@ -1,11 +1,11 @@ # github repo with selinux-policy base sources %global git0 https://github.com/fedora-selinux/selinux-policy -%global commit0 420bacb2c1f970da8f6b71d3338c1968bc1926db +%global commit0 33fd4847deb2522105cfba82da5efb707025934c %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # github repo with selinux-policy contrib sources %global git1 https://github.com/fedora-selinux/selinux-policy-contrib -%global commit1 876387c1df207a8364eacd41e6c0b89d13bba8c3 +%global commit1 4beb213356f6020d4ea6635dda6842cef88fb357 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7}) %define distro redhat @@ -29,7 +29,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.3 -Release: 48%{?dist} +Release: 65%{?dist} License: GPLv2+ Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz @@ -254,12 +254,12 @@ rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u \ -%{_sharedstatedir}/selinux/%1/active/commit_num \ -%{_sharedstatedir}/selinux/%1/active/users_extra \ -%{_sharedstatedir}/selinux/%1/active/homedir_template \ -%{_sharedstatedir}/selinux/%1/active/seusers \ -%{_sharedstatedir}/selinux/%1/active/file_contexts \ -%{_sharedstatedir}/selinux/%1/active/policy.kern \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/commit_num \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/users_extra \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/homedir_template \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/seusers \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/file_contexts \ +%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/policy.kern \ %ghost %{_sharedstatedir}/selinux/%1/active/policy.linked \ %ghost %{_sharedstatedir}/selinux/%1/active/seusers.linked \ %ghost %{_sharedstatedir}/selinux/%1/active/users_extra.linked \ @@ -715,6 +715,251 @@ exit 0 %endif %changelog +* Mon Feb 22 2021 Zdenek Pytela - 3.14.3-65 +- Relabel /usr/sbin/charon-systemd as ipsec_exec_t +Resolves: rhbz#1889542 + +* Wed Feb 17 2021 Zdenek Pytela - 3.14.3-64 +- Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context +Resolves: rhbz#1874527 +Resolves: rhbz#1877044 +- Allow rhsmcertd bind tcp sockets to a generic node +Resolves: rhbz#1923985 +- Allow ipsec_mgmt_t mmap ipsec_conf_file_t files +Resolves: rhbz#1889542 +- Allow strongswan start using swanctl method +Resolves: rhbz#1889542 +- Allow systemd-importd manage machines.lock file +Resolves: rhbz#1788055 + +* Thu Feb 11 2021 Zdenek Pytela - 3.14.3-63 +- Allow rtkit_daemon_t domain set process nice value in user namespaces +Resolves: rhbz#1910507 +- Allow gpsd read and write ptp4l_t shared memory. +Resolves: rhbz#1803845 +- Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type +Resolves: rhbz#1804626 +- Allow Certmonger to use opencryptoki services +Resolves: rhbz#1894132 +- Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm +Resolves: rhbz#1815603 +- Allow rhsmcertd_t read kpatch lib files +Resolves: rhbz#1895322 +- Allow ipsec_t connectto ipsec_mgmt_t +Resolves: rhbz#1848355 +- Allow IPsec to use opencryptoki services +Resolves: rhbz#1894132 +- Allow systemd-importd create /run/systemd/machines.lock file +Resolves: rhbz#1788055 + +* Fri Jan 29 2021 Zdenek Pytela - 3.14.3-62 +- Allow rhsmcertd_t domain transition to kpatch_t +Resolves: rhbz#1895322 +- Revert "Add kpatch_exec() interface" +Resolves: rhbz#1895322 +- Revert "Allow rhsmcertd execute kpatch" +Resolves: rhbz#1895322 +- Dontaudit NetworkManager_t domain to write to kdump temp pipies +Resolves: rhbz#1842897 +- Allow NetworkManager_t domain to get status of samba services +Resolves: rhbz#1781806 +- Allow openvswitch create and use xfrm netlink sockets +Resolves: rhbz#1916046 +- Allow openvswitch_t perf_event write permission +Resolves: rhbz#1916046 +- Add write_perf_event_perms object permission set +Related: rhbz#1916046 + +* Wed Jan 27 2021 Zdenek Pytela - 3.14.3-61 +- Add kpatch_exec() interface +Resolves: rhbz#1895322 +- Allow rhsmcertd execute kpatch +Resolves: rhbz#1895322 +- Allow openvswitch_t perf_event open permission +Resolves: rhbz#1916046 +- Allow openvswitch fowner capability and create netlink sockets +Resolves: rhbz#1883980 +- Add net_broadcast capability to openvswitch_t domain +Resolves: rhbz#1883980 +- Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files +Resolves: rhbz#1883980 +- Allow machinectl to run pull-tar +Resolves: rhbz#1788055 + +* Wed Jan 13 2021 Zdenek Pytela - 3.14.3-60 +- Allow wireshark create and use rdma socket +Resolves: rhbz#1844370 +- Allow to use nnp_transition in pulseaudio_role +Resolves: rhbz#1854471 +- Allow certmonger fsetid capability +Resolves: rhbz#1873211 +- Add rsync_sys_admin tunable to allow rsync sys_admin capability +Resolves: rhbz#1889673 +- Allow sysadm read and write /dev/rfkill +Resolves: rhbz#1831630 +- Allow staff_u run pam_console_apply +Resolves: rhbz#1817690 +- Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t +Resolves: rhbz#1907485 + +* Thu Dec 17 2020 Zdenek Pytela - 3.14.3-59 +- Add cron_dbus_chat_system_job() interface +Resolves: rhbz#1883906 +- Dontaudit firewalld dac_override capability +Resolves: rhbz#1759010 +- Allow tcsd the setgid capability +Resolves: rhbz#1898694 +- Allow timedatex dbus chat with cron system domain +Resolves: rhbz#1883906 +- Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain +Resolves: rhbz#1854299 +- Allow pcp-pmcd manage perf_events +Resolves: rhbz#1901958 +- Label /dev/isst_interface as cpu_device_t +Resolves: rhbz#1902227 +- Allow ipsec set the context of a SPD entry to the default context +Resolves: rhbz#1880474 +- Allow sysadm_u user and unconfined_domain_type manage perf_events +Resolves: rhbz#1901958 +- Add manage_perf_event_perms object permissions set +Resolves: rhbz#1901958 +- Add perf_event access vectors. +Resolves: rhbz#1901958 +- Remove "ipa = module" from modules-targeted-contrib.conf +Resolves: rhbz#1461914 + +* Thu Dec 3 2020 Zdenek Pytela - 3.14.3-58 +- Allow kexec manage generic tmp files +Resolves: rhbz#1896424 +- Update systemd-sleep policy +Resolves: rhbz#1850177 +- Add groupadd_t fowner capability +Resolves: rhbz#1884179 + +* Tue Nov 24 2020 Zdenek Pytela - 3.14.3-57 +- Allow dovecot bind to smtp ports +Resolves: rhbz#1881884 +- Change fetchmail temporary files path to /var/spool/mail +Resolves: rhbz#1853389 +- Set file context for symlinks in /etc/httpd to etc_t +Resolves: rhbz#1900650 +- Allow dnsmasq read public files +Resolves: rhbz#1782539 +- Fix range for unreserved ports +Resolves: rhbz#1794531 +- Introduce logging_syslogd_append_public_content tunable +Resolves: rhbz#1823672 +- Add files_search_non_security_dirs() interface +Resolves: rhbz#1823672 +- Add miscfiles_append_public_files() interface +Resolves: rhbz#1823672 + +* Thu Nov 12 2020 Zdenek Pytela - 3.14.3-56 +- Let keepalived bind a raw socket +Resolves: rhbz#1895130 +- Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid +Resolves: rhbz#1853389 +- Allow arpwatch create and use rdma socket +Resolves: rhbz#1843409 +- Set correct default file context for /usr/libexec/pcp/lib/* +Resolves: rhbz#1886369 +- Allow systemd-logind manage efivarfs files +Resolves: rhbz#1869979 +- Allow systemd_resolved_t to read efivarfs +Resolves: rhbz#1869979 +- Allow systemd_modules_load_t to read efivarfs +Resolves: rhbz#1869979 +- Allow read efivarfs_t files by domains executing systemctl file +Resolves: rhbz#1869979 +- Introduce systemd_read_efivarfs_type attribute +Resolves: rhbz#1869979 + +* Mon Oct 26 2020 Zdenek Pytela - 3.14.3-55 +- Allow init dbus chat with kernel +Resolves: rhbz#1694681 +- Confine systemd-sleep service +Resolves: rhbz#1850177 +- Add default file context for /usr/libexec/pcp/lib/* +Resolves: rhbz#1886369 +- Allow rtkit_daemon_t to uise sys_ptrace usernamespace capability +Resolves: rhbz#1873658 +- Add fstools_rw_swap_files() interface +Resolves: rhbz#1850177 + +* Thu Sep 17 2020 Zdenek Pytela - 3.14.3-54 +- Allow plymouth sys_chroot capability +Resolves: rhbz#1869814 + +* Sun Aug 23 2020 Zdenek Pytela - 3.14.3-53 +- Allow certmonger fowner capability +Resolves: rhbz#1870596 +- Define named file transition for saslauthd on /tmp/krb5_0.rcache2 +Resolves: rhbz#1870300 +- Label /usr/libexec/qemu-pr-helper with virtd_exec_t +Resolves: rhbz#1867115 + +* Thu Aug 13 2020 Zdenek Pytela - 3.14.3-52 +- Add ipa_helper_noatsecure() interface unconditionally +Resolves: rhbz#1853432 +- Conditionally allow nagios_plugin_domain dbus chat with init +Resolves: rhbz#1750821 +- Revert "Update allow rules set for nrpe_t domain" +Resolves: rhbz#1750821 +- Add ipa_helper_noatsecure() interface to ipa.if +Resolves: rhbz#1853432 +- Allow tomcat map user temporary files +Resolves: rhbz#1857675 +- Allow tomcat manage user temporary files +Resolves: rhbz#1857675 +- Add file context for /sys/kernel/tracing +Resolves: rhbz#1847331 +- Define named file transition for sshd on /tmp/krb5_0.rcache2 +Resolves: rhbz#1848953 + +* Mon Aug 03 2020 Zdenek Pytela - 3.14.3-51 +- Allow kadmind manage kerberos host rcache +Resolves: rhbz#1863043 +- Allow virtlockd only getattr and lock block devices +Resolves: rhbz#1832756 +- Allow qemu-ga read all non security file types conditionally +Resolves: rhbz#1747960 +- Allow virtlockd manage VMs posix file locks +Resolves: rhbz#1832756 +- Add dev_lock_all_blk_files() interface +Resolves: rhbz#1832756 +- Allow systemd-logind dbus chat with fwupd +Resolves: rhbz#1851932 +- Update xserver_rw_session macro +Resolves: rhbz#1851448 + +* Wed Jul 29 2020 Zdenek Pytela - 3.14.3-50 +- Revert "Allow qemu-kvm read and write /dev/mapper/control" +This reverts commit f948eaf3d010215fc912e42013e4f88870279093. +- Allow smbd get attributes of device files labeled samba_share_t +Resolves: rhbz#1851816 +- Allow tomcat read user temporary files +Resolves: rhbz#1857675 +- Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain" +Resolves: rhbz#1815281 +- Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t +Resolves: rhbz#1848953 +- Allow auditd manage kerberos host rcache files +Resolves: rhbz#1855770 + +* Thu Jul 09 2020 Zdenek Pytela - 3.14.3-49 +- Additional support for keepalived running in a namespace +Resolves: rhbz#1815281 +- Allow keepalived manage its private type runtime directories +Resolves: rhbz#1815281 +- Run ipa_helper_noatsecure(oddjob_t) only if the interface exists +Resolves: rhbz#1853432 +- Allow oddjob_t process noatsecure permission for ipa_helper_t +Resolves: rhbz#1853432 +- Allow domain dbus chat with systemd-resolved +Resolves: rhbz#1852378 +- Define file context for /var/run/netns directory only +Related: rhbz#1815281 + * Mon Jun 29 2020 Zdenek Pytela - 3.14.3-48 - Allow systemd_private_tmp(dirsrv_tmp_t) instead of dirsrv_t Resolves: rhbz#1836820